Technical Information
Malicious functions
To complicate detection of its presence in the operating system,
adds antivirus exclusion:
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -W H -NoP -C "Add-MpPreference -ExclusionPath '<Current directory>\';Add-MpPreference -ExclusionProcess '<Full path to file>'"
Modifies file system
Creates the following files
- %TEMP%\acroupd_000ed8e7.tmp
- %TEMP%\acroupd_000edd0d.tmp
- %TEMP%\acroupd_000edf4f.tmp
- %APPDATA%\adobe\acrobat\acroupdate.exe
- %APPDATA%\desktop.ini.bak
- %TEMP%\acroupd_000f0759.tmp
- %TEMP%\acroupd_000f8796.tmp
- %TEMP%\acroupd_001012ce.tmp
Deletes following files that it created itself
- %TEMP%\acroupd_000ed8e7.tmp
- %TEMP%\acroupd_000edd0d.tmp
- %TEMP%\acroupd_000edf4f.tmp
- %TEMP%\acroupd_000f0759.tmp
- %TEMP%\acroupd_000f8796.tmp
- %TEMP%\acroupd_001012ce.tmp
Network activity
Connects to
- 'et######-rpc.publicnode.com':443
- '23.##5.2.164':80
- 'et#.#ol.doctor':8443
TCP
HTTP GET requests
- http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?8b##############
Other
- 'et######-rpc.publicnode.com':443
- 'et#.#ol.doctor':8443
UDP
- DNS ASK et######-rpc.publicnode.com
- DNS ASK et#.#ol.doctor
- DNS ASK mo#####.map.fastly.net
Miscellaneous
Executes the following
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -W H -NoP -C "Add-MpPreference -ExclusionPath '<Current directory>\';Add-MpPreference -ExclusionProcess '<Full path to file>'"' (with hidden window)
